Before
An analyst would likely receive the request, prepare or adjust an Elasticsearch query for each domain, run the search, and review the returned host details. They would then format the findings and manually copy them into a Slack channel for team visibility.
How it works
- An email event starts the workflow and supplies the values needed for the search.
- The workflow queries recent DNS records for matches against the specified threat domains and extracts the related host name and IP address.
- The results are formatted and posted to a Slack channel for review.
Workflow details
- Trigger and preparation: An email-triggered event starts the workflow, which retrieves the required variables and formats the search fields before querying the data source.
- Threat-domain query: The workflow builds and runs an Elasticsearch search across packetbeat data sets for DNS queries matching the supplied threat-domain values, limited to activity from the previous hour.
- Relevant evidence: The search requests up to 1,000 matching records and returns the associated host name and host IP fields, keeping the result focused on affected systems.
- Result formatting: The returned search data is transformed into a response format suitable for downstream delivery.
- Team notification: The formatted result is posted to a Slack channel so the relevant activity is available for review without requiring someone to copy and share the search output manually.
What changed
The search, one-hour recency check, domain matching, host-field extraction, formatting, and team handoff now occur automatically after the trigger. The remaining human work is to review the formatted activity delivered in the Slack channel.
Work removed
Manually preparing the Elasticsearch query, running the search, reviewing and extracting host details, formatting the results, and copying the findings into a Slack channel.
Expected outcome
For each trigger, at least four recurring manual actions—query preparation, search execution, result formatting, and team notification—are replaced by one automated workflow, with recent matching activity delivered consistently for review.
